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Abstract 



Oh 

(-H , We study a problem related to coin flipping, coding theory, and noise sensitivity. Consider 

a source of truly random bits x € {0, 1}", and k parties, who have noisy versions of the source 

bits 2/' e {0,1}", where for all i and j, it holds that P[y) = Xj] = 1 — e, independently for 

all i and j. That is, each party sees each bit correctly with probability 1 — e, and incorrectly 

(flipped) with probability e, independently for all bits and all parties. The parties, who cannot 

communicate, wish to agree beforehand on balanced functions fi : {0, 1}" —f {0, 1} such that 

^ I P[/i(j/^) = . . . = fk{y^)] is maximized. In other words, each party wants to toss a fair coin so 

'b! ' that the probability that all parties have the same coin is maximized. The functions fi may be 

thought of as an error correcting procedure for the source x. 

\^ • When fc = 2, 3 no error correction is possible, as the optimal protocol is given by fiix"^) — y\- 

(^ I On the other hand, for large values of fc, better protocols exist. We study general properties 

^^ ' of the optimal protocols and the asymptotic behavior of the problem with respect to k, n and 

^^ I e. Our analysis uses tools from probability, discrete Fourier analysis, convexity and discrete 

r^ ' symmetrization. 

-(— > 



1 Introduction 



Consider a source of truly random bits x E {0, 1}", which is accessible to k parties. If the k parties 
C^ ' want to use the source in order to obtain a common single random bit, they can easily do so by 

deciding beforehand to let the common bit be xi. More generally, they can decide beforehand on 
any balanced function / : {0, 1}" -^ {0, 1}, and let the common bit be f{x). We call a function / 
balanced if P:,[/(x) = 0] = Px[f(.x) = 1] = 1/2. 

In this setting, there is no real advantage in taking the function / to be anything other than 
f{x) = xi. The problem becomes more interesting when the parties receive noisy versions of 
the random bits. That is, party i receives y*, where the bits of y* satisfy P[y*- = Xj] = 1 — e, 
independently for all i and j. We also assume that the parties cannot communicate. Yet, the 

*The work reported here was conducted while the author was a PostDoc at the Theory Group, Microsoft Research 
1"Supported by NSF grant CCR-99-12342. 



parties want to toss the same fair coin given their noisy versions of the source. We will now allow 
each party i to use a different balanced function /j : {0, 1}" -^ {0, 1} as a coin-tossing procedure. 
We want to maximize P[fi{y^) = . . . = fk{y^)]- 

This problem is motivated naturally by several models in cryptography. Think of a long one- 
time pad which is distributed to parties with a small probability of error. The parties still want to 
use this one-time pad as their key to an encryption algorithm, by dividing the one-time pad into 
blocks of length n, and applying some function on each block to obtain a shorter one-time pad 
which has high probability of being the same for all parties. One setting in which such a procedure 
should be useful is Ding and Rabin's "everlasting security" |DR01j . a strong encryption algorithm 
in the bounded storage model. This model presupposes the existence of a satellite broadcasting 
a continuous stream of a huge number of random bits. It is natural to expect some error in any 
reception of this stream. A somewhat related cryptographic problem was studied by Maurer |M97j : 

Our problem is also of interest as a noncryptographic collective coin flipping problem. One 
example of such a problem is the full information model, introduced by Ben-Or and Linial JBL90J 
and studied extensively (see, e.g., the survey |Dflnj ). In this problem, many parties try to agree on 
a single random bit; each generates a random coin toss, and there is a single protocol (function) 
taking all the coin tosses and producing a bit. The difficulty arises from the assumption that some 
parties are corrupt and can choose their coins adversarially. In our problem, the major difference 
is that the parties do not communicate any random bits, so they each must apply a protocol to a 
shared random string. And, instead of arbitrary corruptions, we assume random ones. 

The question presented in this paper is also a natural question regarding error correcting for 
the broadcast channel (see e.g. |(yT91j ) with a truly random source. Naturally, when the source 
is truly random, error correction is impossible. However, here instead of requiring that all parties 
receive the information transmitted to them with high probability, we require that all parties attain 
the same information with high probability, and that this mutual information has high entropy. 

Finally, a basic motivation comes from the study of noise-sensitivity, see |KKL88j and |BKS99j . 
The functions fi that maximize the probability P[/i(y^) = . . . = fk{y )] are in an intuitive sense 
stable to noise, and it turns out that when the number of parties /c is 2 or 3, this intuition can be 
used in order to prove that the optimal functions are just the first-bit function. Our results for 
larger values of k are part of an initial attempt for bounding high norms of the Bonami-Beckner 
operators in the range where the results of [BoTOj and |Be75j do not apply. 

1.1 Definitions and notation 
Definition 1.1 

• The model Let k > 1 be the number of parties, and n > 1 be the block length. Let e S 
(0, 1/2) be the corruption probability. Our space is the space of all sequences {x,y^, . . . , y^) G 
{0, ij^xi^-'+i)^ where x represents the source and is chosen uniformly at random from {0, 1}". 
For each i, y* represents the bits that party i holds and it is assumed that for all 1 < i < k 
and 1 < j < n, it holds that P[y*- = Xj] = 1 — e, independently for all i and j. This is our 
probability space, and when we write P (or Ej we mean the probability (expected value) in 
this space. 



• Balanced and antisymmetric functions Let Bn denote the set of balanced functions f : 
{0,1}" -^ {0,1}; i.e., those with |/^"'^(0)| = |/^^(1)|. Let An denote the set 0/ antisymmetric 
n-bit boolean functions; i.e., those satisfying /(xiX2 • • • x„) = f{x), where the bar denotes 
flipping O's and I's, so x = 1 — x. Note that An C S„. 

• Protocols A protocol consists of k functions fi G Bn. An antisymmetric protocol consists of 
k functions fi £ An- For a protocol (/i, . . . , fj^), we write V{fi, . . . , /fc; e) for the probability 
that all functions agree, so 

P(/i,...,/fc;6)=P[/i(yi) = ... = /fc(/-)]- 
We write Vk{f; e), in place ofV{fi, ...,fk;e), if fi = . . . = f^ = f . 

It turns out that restricting all fi to be balanced is neither necessary nor sufficient for ensuring 
that the output bit, when agreed upon, is uniformly random — see Proposition 15.31 for a counterex- 
ample to sufficiency. A sufficient condition is that every function be antisymmetric, since if all the 
function are antisymmetric, then 

P[/i(y') = • . . = A(/) = 1] = P[/i(7) = fk{^) = 0] = P[/(yi) = . . . = /(/) = 0], 

where the first equality follows from the fact that fi are antisymmetric and the second since P 
assigns the same probability to (x, y^, . . . , y ) as it does to (x, y-^, . . . , y^). We are not aware of a 
weaker condition than antisymmetry that ensures that the output bit when agreed upon is uni- 
formly random. 

We end this section with a few more definitions. For S C [n] and vr a permutation of [n], let 
TTs : {0, 1}" -^ {0, 1}" be defined by 'ns{x)i = a;^(j) iii £ S, and T:s{x)i = x;;^ \ii ^ S. Any -ks 
merely permutes coordinates, and flips the roles and and 1 on some coordinates. It's therefore 
easy to see that V{fi o7rs,...,fk° tts] e) = 'Pifi, • • • , fk] e) for any vrg. 

In order to express uniqueness results cleanly, we abuse language in the following way: For 
particular k, n, and e, we say that (/i, . . . , fk) is the unique best protocol "up to tts" if the set of 
best protocols is exactly {(/i o vrg, . . . , /^ o vrg) : S CI [n], vr G Sn}- 

Remark 1.2 Those familiar with the Bonami-Beckner operator (see Definition VJ.l)) will note that 
'Pkifi^) = ll^e/llfc + ll^e(l ~ f)\\k- Therefore we are looking for balanced boolean functions having 
large k'th norm, for various values of k. 

1.2 Main results 

Methods of discrete Fourier analysis (see |KKL88| IBKS99| IM()n2j for background) give an exact 
solution to our problem in the cases k = 2,3, and the best protocol, up to vrg, is for all parties to 
use the function f{x) = xi. We attribute the case A; = 2 in the following theorem to folklore. 

Theorem 1.3 For all k, n, e, if we wish to maximize the expression 

Bmi,j):f,iy^) = f,iyn], (1) 



the unique best protocol up to tts is given by fi = . . . = fk = f , where f{x) = xi. In particular, if 
k = 2 or k = 3, then for all n and e, the unique best protocol up to tts for maximizing 'P(/i, . . . , /fc; e) 
is given by fi = . . . = fk = f, where f{x) = xi. 

In general we do not know how to find the optimal protocol. However, we can prove some general 
properties of the protocols which maximize P(/i, . . . , /fc; e). Recall that a function / is monotone 
if for all x,y G {0, 1}", we have f(x) < f{y) whenever x ^ y (in the sense Xi < yi for all i). For 
x,y G {0,1}", we write x :<l y if X^I^Li ^« — Yl^iVi ^^^ every m = l...n. We call a function 
/ left-monotone if f{x) < f{y) whenever x <l V- Note that the partial order induced by :<l 
is a refinement of the partial order induced by :<; in particular, every left-monotone function is 
monotone. 

The following theorem is based on convexity and on the Steiner symmetrization principle (see 
e.g. |T93j for background). 

Theorem 1.4 For all k, n, and e, any protocol which maximizes V{fi, . . . , fk', e) among all proto- 
cols satisfies fi = ■ ■ ■ = fk = f , where f is left-monotone (up to ns)- This theorem remains true if 
the phrase "protocol" is everywhere replaced by "antisymmetric protocol". 

So far we haven't ruled out the possibility that the optimal protocol always consists of taking 
just one bit. For r an odd number, let MAJ^ denote the majority function on the first r bits; i.e., 
MAJr(x) is 1 if Yl"[=i ^i > ^f^ ^^d MA^rix) = if Yll=i ^i < ^/^- Using a coupling argument, we 
prove the following result: 

Theorem 1.5 For all n odd, and all e, there exists a K = K{n, e) such that for k > K , the unique 
best protocol up to tts is given by fi = . . . = fk = MAJ„. Moreover, as k ^ oo, 

Pfc(MAJ„; e) = e f (1 - P[Bin{n, e) > n/2])M , (2) 



where Bin{n,e) is a binomial variable with parameters n and e. (This should be compared to 
0((1 — e)'^) for the function f{x) = xi.) When n is even, a similar result is true; in place of MAJ^, 
one should take any balanced function f which has f{x) = 1 whenever \{i : Xi = 1}| > \{i : Xi = 0}\, 
and f(x) = whenever \{i : Xi = 0}\ > \{i : Xi = 1}\. 

A dual result is obtained by fixing n and k, and letting e be either close to or close to 1/2. 

Theorem 1.6 For all k and n, there exist < e' = e'(n, k) < e" = e"{n, k) < 1/2, such that for all 
< e < e', or e" < e < 1/2, the unique best protocol up to tts is given by fi = . . . = fk = f , where 
f{x) = xi;i.e., / = MAJi. 

It may now seem like the optimal protocol consists of either taking all functions to be MAJ„ or 
all functions to be MAJi. This is not the case however, as a computer-assisted proof shows that 
sometimes MAJ^ is better than MAJi and MAJ„ for 1 < r < n. See Proposition 15.21 

Despite Theorem II. 5| it is not true that as A; — > oo, the success probability of the best protocol 
goes to exponentially fast in k (treating e as fixed). In fact, if we allow n to be an unbounded 
function of k, then the best protocol's success probability is at least inverse-polynomially large in 
k. 



Theorem 1.7 Fix e. Then there exists a sequence (n^) such that 

1 



Pfc(MAJ„,,;e)>f] 



^*^-J - ^^ ^2.01/(l-2e)2 

It suffices to have Uk = 0{k^-°^/^^-^''^'). 

Finally, it is natural to ask if the optimal function is always MAJ^ for some 1 < r < n (assuming, 
say, n is odd). 

Conjecture M: For a particular k, e, and odd n, there is a function f £ An which is not a 
majority function such that Vk{f',() > 'Pfc(MAJm; e) for all odd m < n. 

Conjecture O: For any given k, e, and odd n, there is an odd m <n such that the best antisym- 
metric function for the parties is MAJ^- 

In fact, we know of no counterexample to Conjecture O even if we allow the parties to use 
any balanced function (which could allow for a biased output). Some evidence that resolving this 
conjecture could possibly be hard: One, it is not true that for any non-majority function /, and any 
fixed A;, there is a majority function which dominates / over all e — we have a computer- verified 
counterexample. Two, for certain A;,e, 'Pfc(MAJ„,e) is not even unimodal as a function of n. E.g., 
for /c = 12, e = 0.1, the success probability decreases between MAJi and MAJ3, increases up to 
MAJii, and then decreases again out to MAJ17 (and appears to continue decreasing from this point 
on). 

We conclude the introduction with a road map to the following sections. In Section |2l we 
prove Theorem 11.31 using Fourier analysis. In Section |31 we prove the Theorem 11.41 using Steiner 
symmetrization and convexity. In Section |3 we prove Theorems II. 5| II. 6( and 11.71 — the arguments 
in this section are mostly probabilistic. Finally, in Section[21we discuss the results of some computer 
analysis, and pose two more open problems. 

1.3 Results obtained subsequent to this work 

Several new results have been proven about the cosmic coin problem subsequent to this work. 
Perhaps the most interesting asymptotic setting of the parameters is that of Theorem 11.71 e fixed 
and k — > 00, with n being unbounded. It has since been shown that in this setting the optimal 
success probability of the players is precisely Q{k~^), where v = v{e) = ii__2^\i 1 ^'^^ ©(■) denotes 
asymptotics to within a subpolynomial {k°^^') factor. The upper bound comes simply from a 
more careful analysis of the success probability of the majority protocol. Much more interesting 
is the lower bound, which is proved using a reverse hypercontractive property of the Bonami- 
Beckner operator proven in |Bor82j (c.f. usual uses of the hypercontractive property in |KKL88j 
and subsequent works). 

In addition, the same problem on different tree structures has been studied. The problem in 
the present paper corresponds to a star graph with k leaves, with the initial random string at the 
root distributed to the k players along the edges. The corresponding problem on the line graph 



has subsequently been studied, and it is shown that for n unbounded and fixed e the agreement 
probabihty decays exponentiahy in k. This is different from the star where the decay rate is 
polynomial in k. 

See |MURSS03j and also preliminary expositions from |U03j . 

2 Fourier methods 

In this section, we make a usual notational switch; the bits and 1 will be denoted by +1 and —1, 
respectively. Note that / : {+1,-1}"' — > {+1,-1} is balanced iff" E[/] = 0. Given the functions 
of the parties /i, • • • , /fc : {+1, —1}" -^ {+li ~1}) '^e view these as functions in the larger space 
{+1, — ij^^C^+i) in the natural way: /j(x,y^, . . . ,y^) = fi{y'^). Our probability space gives rise to 
a natural inner product on functions f,g : {+1, — 1}"^('^+1) -^ R: 

if, 9)= E [f{x,y\...,y'')g{x,y\...,y')]. (3) 



Lemma 2.1 

k 
Y^ iUJj) = 2B[#{i,j) : fM) = fj{y^)] - k\ 

Proof: Since the fi are ±1 valued functions, 

k k 

k 

= Y. (2P[/,(y^) = /,(y^-)] - 1) = 2E[#(z,i) : h{y^) = f^{yi)] - k\ 

n 

Now, in order to maximize the quantity in (^, we analyze the scalar products {fi,fj). In 
order to analyze scalar products, it is useful to work with the Fourier basis. We refer the reader 
to |KKL88[lRK^^99llM()n2j for background. For a set 5 C [n], we let Ui^s ■ {+1, -1}"''(*^+^) ^ 
{+1, —1} be defined by: 

Since the k j/j's are independent, it follows that if 5 7^ S" then for all i,i', 

{U^,s,U,,s')=0. (4) 

Moreover, if i 7^ i' then 

{U,,s, U,,s) = nU ^d\ = n E[yjyj'] = (1 - 26)^1^1, (5) 

jes jes 

and the functions Ui^s all have norm 1, so {Ui^s, Ui^s) = 1- 



Lemma 2.2 Let i ^ j. Then 



max {n{y^),f,{y^)) = {l-2ey 



and the maximum is obtained when fi = fj = f and f{x) = ztx^ for some \ <r <n. 

Proof: Express fi and fj in terms of their Fourier expansion, fi = Ylisc\n] fii'^)^i,s and similarly 
for fj. Since, both fi and fj are balanced, and E[C/j^s'] = E[Uj^s] = for nonempty S, it follows 
that /j(0) = /j(0) = 0. Now by © and ® it follows that 

{fiJj)= E MS)MS){l-2ef\'\. (6) 

0^SC[n] 

Hence we have: 

(/■„/,) = E (l-26)l^l^,(5)(l-26)l^l/,(5) 

07^SC[n] 



- / E (l-2e)2|^l/i(5)2 / ^ (l-2e)2|S|/^.(5)2 (Cauchy-Schwarz) 



< / E (l-2e)2/,(5)2 / ^ (l-26)2/,-(5)2 

= (l-26)^ 

as X^/i('S')^ = Ylifji^)"^ — 1- The second inequality is tight only if fi and /j have Fourier degree 
1. Note that if f{x) = ^\s\=i f{S)us{x) is a function which is ±1 valued, then for all S of size 1, 
it holds that 2/(5') = f{x) - f{x © e^) G {-2, 0, 2}. It follows that f{x) = ±Xr for some r. 

In this case, the first inequality is tight only if fi and fj are the same one-bit function. Hence, 
as claimed, fi = fj = f where f{x) = ztx,- constitutes the only maximizing solution. □ 

We can now prove Theorem II. 31 

Proof: [of Theorem II. 3j By Lemma |2. II it follows that maximizing E[7^(i,j) : /i(y*) = fjiy-')] is 

the same as maximizing, 

k 

By Lemma 12.21 the above sum is maximized when fi = ■ ■ ■ = fk = f, and f{x) = xi up to tts- We 
thus obtain the first assertion of the theorem. 

For the second assertion, note that when k = 2, 

E[#(i, j) : /.(y^) = f,iy')] = 2 + 2P[/i(/) = f,iy% 
while when A; = 3, 

E[#(i,j) : f^iy') = /,(y^)] = 5 + 4P[/i(yi) = ^(y^) = f,(y% 
so the second assertion follows. □ 



3 Convexity and symmetrization 

We now show that to maximize 'P(/i, . . . , fk', e), it suffices to look at restricted sets of functions. 
The methods in the section are related to convexity in general and the Steiner symmetrization in 
particular, see e.g. jT93j for background. 

We begin with a definition and a simple Fourier Lemma (The Bonami-Beckner operator Te(/) 
was first defined in |Ee75l lEHTnl . see also JKKL88L lEK?^ 1 

Definition 3.1 For f : {0, 1}" -^ R, given by f{x) = EscN f(^)^s(^)' ^^^ 

Uf){x)= Y,f{S){l-2ef\us{x). 

S<Z[n] 

Lemma 3.2 Given e and f : {0, 1}" -^ {0, 1}, T^{f){x) equal the probability that a particular party 
using f outputs 1, given that the source string is x. If f and g are different boolean functions on 
{0, l}", then for every < e < 1/2, there exists some x G {0, 1}" for which Tf^{f){x) ^ T^{g){x). 

Proof: Note that given a source x and an e corrupted version of x, y, the expected value of us{y) 
is given by (1 — 2ey^\us{x) (an easy calculation; see e.g. |BKS99j for a full proof). Therefore, by 
linearity of expectation, it follows that for all / : {0, 1}" -^ M, T^{f){x) is the expected value of 
/(y), where y is a corrupted version of x. In particular, if / : {0, 1}" -^ {0, 1}, then T^{f){x) = 
■^[/(y)] = ■P[/(y) — 1] ^'^'i ^^ proved the first assertion of the lemma. 

For the second assertion note that for < e < 1/2, T^ is by definition a reversible linear 
transformation on the space of all function from {0, 1}" ^ M. □ 

Now, using convexity, we prove that all parties should use the same function: 

Proposition 3.3 Fix k, n, and < e < 1/2. Let C be any class of boolean functions on n bits. 
Subject to the restriction that /i, . . . , A G C, every protocol which maximizes V{fi, . . . , fk]e) has 
fi = ■ ■ ■ = fk- 

Proof: Let C = {/i, /2, . . . , fu}, and assume M > 1 - else the proposition is trivial. Suppose that 
among the k parties, exactly tj use the function fj. Then clearly, 

M 

tj > 0, ^ tj = k, tj £ Z. (7) 

3=1 

The probability that all parties agree is: 

(M M \ 

n (Te(/,)(x))*^ + n (1 - ^^(/i)(^))*^ ■ (8) 

Note that each T^{fj){x) G (0,1) and that for any c G (0,1), the function g{t) = c*, is log- 
convex (since logc* = tlogc is linear). Therefore the function gi---gM '■ R — *■ R given by 
(ti, . . . , ^m) i-^ n7=i dji^j) is a log convex function, and therefore a convex function. 



Since the sum of convex functions is also convex, "P is a convex function of the tj's. We wish to 
maximize V subject to the restrictions Q. 

If we relax the assumption tj G Z to tj £ M, we are simply maximizing a convex function 
over a convex bounded polytope. The vertices of the polytope are simply the points of the form 
(0, . . . , 0, fc, 0, . . . , 0). The maximum must occur at a vertex, and so it follows that there is at least 
one maximizing protocol in which all players use the same function. 

It remains to show that V doesn't obtain the maximum at any point which is not a vertex of 
the polytope. Note that by convexity, if V has a maximum which is not a vertex of the polytope, 
then there exists an interval / = {tvi + (1 — t)v2 : t G [0, 1]}, where vi and V2 are vertices of the 
polytope, such that / is a constant function on /. Therefore if we could show that / is strictly 
convex on / (as a function of t), then it will follow that the maximum is obtained only at vertices 
of the polytope. 

note that when restricted to the edge / joining, e.g., vi = {k,0, . . . , 0) and V2 = (0, /c, 0, . . . , 0), 
V is given by: 

^ = E 2"" {iTeifiXx))^" (T,(/2)(x))(i-")^ + (1 - Uh)ix)f' (1 - T,{h)ix)f-'^'') . 

a;G{0,l}" 

By Lemma|2I21 we can find an xq such that Tf^{fi){xo) and Tf^(f2){xo) differ. Therefore the function 

is strictly convex, and V is strictly convex on I as needed. □ 

Next we use Steiner symmetrization principle in order to obtain more information on functions 
which optimize V{fi, ■ ■ ■ , fk] e)- Recall that for x,y £ {0, 1}", we write x ^ y if for all i E [n] it 
holds that Xi < yi, and we say that / is monotone if /(x) < f{y), whenever x < y. Similarly for 
S C [n], we may write x :<s y, if Xi < yi for i £ S, and yi < xi for i ^ S. We call a function / 
which is monotone with respect to ^5, 5-monotone. 

Proposition 3.4 Let C stand for either B^ or A^.. For any k, n, e, if f is restricted to be in C, 
and the maximum ofVk{g] e) is obtained at g = f , then f is S -monotone for some set S. Moreover, 
there exists f £C which maximizes Vk{g',e) and is monotone. 

Proof: Let / S C be any function which maximizes Vk{f]^) among functions in C. Let /' be 
obtained from / by "shifting" up in the first coordinate: Given x G {0, 1}"^^, 

. if /(Ox) = /(Ix), then set /'(Ox) = /'(Ix) = /(Ox) = /(Ix); 
• if /(Ox) / /(Ix) then set /'(Ox) = 0, /'(Ix) = L 

It is easy to see that in the case C = Bn, f remains in C; a little thought reveals that this is again 
true in the case C = A„ . 



For y G {0, 1}", let y G {0, 1}"^^ be the last n - 1 bits of y. We claim that Vkif; e) > r{f; e). 
To show this, it suffices to show that for all z^, . . . , z^ G {0, 1}"~^, 

P[f{y') = ... = f'{y'')\f = z\...,f = z>^]>F[f{y') = ... = f{y'^)\f=z\...,f = z']. 

So suppose each y^'s last n — 1 bits are fixed to be z*. Given z*, /(y*) is a function from {0, 1} to 
{0, 1}, and is therefore either the constant function 0, the constant function 1, the identity function 
id, or the function x — > x, which we denote by id. 

If /(y*) is already determined by z*, then so is f'{y^) and the determined value is the same. 
Otherwise, /(y*) is a function of the one remaining unknown bit, y\, and is either the function id 
or id. In either case, f'{y^) is the identity function on y\. 

Assume that given (z^, . . . , z ), there are a + b undetermined functions f{yi), with a of them 
id, and b of them id. The probability that all of these functions agree on (or 1) is 

g = i ((1-6)^ + 6^(1-6)'' 

and the probability that all of the undetermined /"s agree on (or 1) is 

1 



- ( (1 - €f+^ + 6"+'' 



There are three cases to consider: 



• If some of the determined functions are determined to be and some to be 1, then both terms 
in ® are zero. 

• If all of the determined functions are determined to be (1), then the left side of @ is q' and 
the right side of @ is q. 

• If there are no determined functions, then the left side of © is 2q' and the right side of Q 
is 2q. 

Therefore the claim will follow once we show that q' > q. 



^« 



1 - 6)^^+* + 6'^+'') > - ((1 - 6)^6'' + 6"(1 - 6)" ) (10) 

a+b / \ b 



which follows by the convexity of the function t -^ ( j^ 1 . 

Thus we've established Vkif', e) > 'P{f; e). We further claim that this inequality is strict unless 
/ was already monotone or anti-monotone on the first coordinate. If / is neither monotone nor 
anti-monotone on the first coordinate, then there exist z^ and z^ such that /, when the last n — 1 
coordinates are restricted to z^, becomes id, and when the last n — 1 coordinates are restricted to 
z'^, becomes id. Picking z"^, . . . , z so that all the other restricted functions are either id or id, we 
obtain a,b> 1, so (fTTjl is strict inequality and therefore q' > q. 
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Repeating the above argument for all other coordinates, it follows that any maximizing function 
/ must be S monotone and that there exists a maximizing function which is monotone. □ 

Recall that for x,y & {0, 1}", we write x :<l y if YlT^i ^« — YlT^i Vi ^^"^ every m = 1 . . .n, and 
that we call / : {0, !}"■ -^ {0, 1} left-monotone, if f{x) < f{y) whenever x :<l y- 

Proposition 3.5 Let C stand for either Bn or An- Let k, n, and < e < 1/2. Suppose that f 
maximizes Vk{f', e) in C, then up to tts, f is left-monotone. 

Proof: The proof is similar to the proof of Proposition 13.41 so we will be more brief. By Proposi- 
tion 031 we may assume that / is monotone. 

Now apply a new sort of shift to /. Suppose we fix all but two input bits to /. Since / is 
monotone, there are only 6 possibilities for what the restricted function is; its support may be 0, 
{11}, {11,10}, {11,01}, {11,10,01} or {11,10,01,00}. Define /' to be the same function in all 
cases except when the support is {11,01}; in this case, switch it to {11,10}. This rule preserves 
balance and asymmetry. 

We want to show that Vk{f'', e) > 'Pkif] e)- As before, we condition on all but two bits of each 
of yi, . . . , yfc, and show that /' is better. Say that under this conditioning, a of the /(y*)'s restrict 
to the function with support {11,10}, and h of the /(y*)'s restrict to the function with support 
{11,01}. Since all other possible restricted functions have the same value for 01 as they do for 
10, it suffices again to compare the probability with which the a + h functions agree on 1 with the 
probability that the corresponding shifted functions agree on 1. Further, by symmetry, we need 
only consider the cases when the two source bits from x are different (otherwise / and /' do equally 
well). 

So considering the two cases — the source bits are 10 or the source bits are 01 — we get 
that the contribution from the /-restricted functions will be (1/2)((1 — e)"e ) -|- e (1 — e)"), and the 
contribution from their shifted versions will be (1/2)((1— e)°"'"*-|-e°"'"*). As we saw in ProDosition l3.41 
this latter quantity is always at least the former quantity. Hence the shift can only improve the 
probability of agreement. 

Hence we indeed have 'Pfc(/';e) ^ 'Pkif',^)- If we repeatedly apply this shift to all pairs of 
coordinates, we end up with a left-monotone function. 

Note that if none of the shifting operations strictly increased the probability of agreement for 
/, then for every pair of coordinates (i, j) which were shifted, either all the balanced restrictions of 
/ to coordinates (i,j) have support {11, 10}, or all the balanced restrictions have support {11,01}. 
In either case, all the shifting did is to replace the functions / by a function / o 7r0, where 7r0 is the 
transposition of coordinates {i,j). It thus follows that the original function was left monotone up 
to some 7r0, as needed. □ 

Proof: [of Theorem II. 4j The proof follows from Propositions 13.31 13.41 and 13.51 □ 

4 Majorities 

In this section we study majority functions and show that these function are optimal for some 
limiting values of k and e. 
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4.1 Fixed e, n; A; ^ oo 

We start by proving Theorem 11.51 Given a function / : {0, 1}" -^ {0, 1}, let pi(/, x, e) denote the 
probabihty that f{y) = 1, given that y is an e-corrupted version of the string x G {0, 1}". Let po 
be defined similarly for the probability that f{y) = 0. 

Proposition 4.1 Fix e, and let f be monotone. Then as a function of x, pi{f,x,e) is maximized 
at X = 1 = 1- ■ -1, and po{f, x, e) is maximized at x = = 0- • -0. 

Proof: We prove the claim for pi, the proof for pQ being the same. Note that flipping each bit of 
a string with probability e is the same as updating each bit with probability 2e, where an update 
consists of replacing the bit with a random choice from {0, 1}. 

Let x £ {0, 1}" be any sequence. Let x' be an e corrupted version of x, and V be an e corrupted 
version of 1. We claim that we can couple the random variable x' and 1' in such a way that x' ^ 1'. 

The coupling is achieved in the following simple way: update the same bits of x and 1 with the 
same values. Clearly, we have x' :< 1' . Hence by monotonicity if f{x') = 1, then /(I') = 1. The 
result follows, as 

p,{f, X, e) = P[/(x') = 1] < P[/(r') = 1] = pi(/, 1, e). 

D 

Proposition 4.2 For fixed e, pi{f,l,e) and pQ{f,0,e) are maximized among f £ Bn by any func- 
tion which is on all strings with fewer than n/2 I's. In particular, if n is odd, f = MAJ^ is the 
unique maximizing function. 

Proof: We prove the assertion about pi. 

pi(/,r,e)= Y. (i-6r-^(-'5')e^(--r), 

x'e/-i(i) 

where A denotes Hamming distance. The quantity being summed is a strictly decreasing function 
of A(x, 1). The result follows. □ 

Proof: [of Theorem II. 5j We prove the theorem for n odd. The proof for n even is essentially the 
same. By Theorem 11.41 we may assume without loss of generality that all parties use the same 
monotone function f £ Bn- Now: 

V{MAJn,k,e) = 2-" J^ (pi(MAJ„,x, e)'= + (po(MAJ„,x, e))'=) (12) 

a;G{0,l}" 

> 2-" (piiMMn, I, e)' + PoiMA^n, 0, e)'=' 
By Proposition 14.11 if / is monotone, then 



r{f,k,e) = 2-" Y. {pi{f,x,e)'' + {po{f,x,e))'^) (13) 

i'e{o,i}" 

< 2-" Y. (pi(/,r,e)'=+Po(/,0,e)^)=pi(/,r,e)'=+Po(/,0,e)^ 

a;e{0,l}" 
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By Proposition 14.21 if f £ Bn is monotone, and / 7^ MAJ„, then pi{f,l,e) < pi(MAJ„,l,e) and 
Po(/>0, e) < po(MAJ„,0, e). Hence for sufficiently large k, we will have 

2->l(MAJ„,^,e)'=>pl(/,^,e)^ 2->o(MAJ„,0,e)'^>po(/,0,e)^ (14) 

Combining (fT^ . (jT^ and ((T^ we obtain that 'Pfe(MAJ„;e) > Vk{f]e) for all monotone f £ Bn as 
needed. 

Bound © follows from (HU, ((131), and (O once we note that 

Po(MAJ„, 0, e) = pi(MAJ„, 1, e) = 1 - P[Bin(n, e) > n/2]. 
U 

4.2 Fixed k, n; e^Q or 1/2 

Proposition 4.3 For all k and n, there exists e'{k,n) > 0, such that for all < e < e'{k,n), the 
unique best protocol up to tts for maximizing V{fi, . . . , fk',e) is given by fi = . . . = fk = f , where 
f{x) = Xl. 

Proof: From Proposition I.S. 31 it follows that the maximum can only be obtained if fi = . . . = fk = 
f. Note that the probability that there is more than one corrupted bit is O(e^) (the constant in 
the O(-) does depend on k and n). Suppose that only the ith bit for party j was corrupted. Then 
all the parties will agree if and only if f{x) = /(x © ej), where x © ej is the vector x with the ith 
bit flipped. We therefore obtain, 

n 

Vkif; 6) = (1 - e)'=" + ke{l - eT^-^ Y. P-[-^(^) = /(^ ® ^^)] + ^i^^)' (^5) 

Writing A for the set {x : f{x) = 1}, and dE{A) for the edge-boundary of the set A, 

dsiA) = U"=i{(x,x©ei) ■.xeA,xe)ei^A}, 
we see that 

n 

J] P,[/(x) = fix © e,))] = n - 2-^+'dE{A). 

1=1 

So for small e (compared to k and n), in order to maximize Vk{f', e), we should minimize dE{A) for 
sets such that \A\ = 2"~^. By the isoperimetric inequality for the cube, the sets A which minimize 
dE{A) among all sets of size 2"~^ are exactly the sets A = {x : Xi = 0} , or A = {x : Xi = 1} . Thus 
/ must be /(x) = xi up to vr^, as claimed. □ 

Proposition 4.4 For all k and n, there exists e'{k, n) < 1/2, such that for all eps'{k, n) < e < 1/2, 
the unique best protocol up to its for maximizing 'P(/i, . . . , /fc; e) is given by fi = . . . = fk = f , 
where f{x) = xi. 
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Proof: Again, Proposition 13.31 implies that we need only consider the case fi = ■ ■ ■ = fk = f ■ In 
this proof it will be helpful again to assume that the bit values are ±1, so we want to show that 
the maximizing functions are f{x) = Xj, or f{x) = — Xj. 

It will be useful to work with the "updating representation". Let X{i,j) for 1 < i < k and 
1 < i < "- be a sequence of i.i.d {0, 1} variables s.t. P[X{i,j) = 1] = 6 = 1 — 2e. Note that we 
may produce the y*'s from x in the following manner. If X(i,j) = 1, then y*- = Xj, otherwise y*- is 
chosen uniformly at random from {+1, —1} independently from everything else. 

Note that if all the X{i,j) are 0, the inputs to the functions are independent, so for all balanced 
/'s, 

P[/(y') = • . . = /(/) I E ^^^J = 0] = 2"'^'- 

Similarly for all balanced /, 



P[/(yi) = ... = /(/) I Y,X,, = 1]=T 



-k+l 
^'■hJ — ij — ^ ) 

and for all i, i' and j ^ j' , 

-fc+i 

^^s,t — ^\ — ^ 
s.t 



P[/(y') = • • • = /(/) I Xi,i = x,,r = i,E^^.* = 2] = 2- 

Moreover, 



E^M>2 



2J 



0{5" 



(the constant in the O(-) depending on k and n). 
We therefore conclude that 

n 

Vk{f;e) = ck + 5^1 - 5)"'=-2 J^^P[/(2/^) = . . . = /(/) I X,,, = X,j = 1] + 0(6'), (16) 

where Ck is independent of /. Writing z for a uniformly chosen element of {+1, —1}'^, and z' for an 
element which is chosen by picking 1 < i < n uniformly at random, and then choosing z' G {0, 1} 
uniformly among all z' s.t. z'^ = Zi, we obtain, 

n 

5;^P[/(yi) = . . . = /(/) I X,, = X,, = 1] = nk{k - l)F[f{z) = /(/)]. (17) 

Therefore, if we could show that P[f{z) = f{z')] is maximized among all balanced functions / 
when f{x) = xi up to its, then the proof will follow from (|16|) . 

In order to prove this claim, we note that 

P[f{z) = f{z')] = {l + E[f{z)f{z')])/2. 
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It therefore suffices to maximize 'E[f{z)f{z')] over all balanced functions /, i.e., functions with 
/(0) = E[/] = 0. We pass to the Fourier representation as in the proof of Theorem 11.31 It is easy 
to see that if us{x) = Oies^*' then 

r usiz) if 5 = 0, 

B[usiz')\z] = I us{z)/n if|5| = l, 
[^ otherwise. 

So, 

and equality is achieved iff f{x) = Xi, or f{x) = —Xi as needed (see proof of Lemma l2.2() . □ 
Proof: [of Theorem II. 6j Follows immediatelv from Propositions 14.31 and 14.41 □ 

4.3 Fixed e; fc — > oo with n unbounded 

Finally, we prove Theorem ll.71 

Proof: [of Theorem II. 7j Fix e and k. We consider 7^fc(MAJ„; e) as a function of n, as n ^ cxd 
through the odd numbers. Our proof will go by showing that there is at least a Q.{l/k'^'^^'^^~'^''' ) 
chance that the source string x has significantly more I's than O's. Then we show that in this case, 
the probability any particular party says 1 is at least 1 — l/Zc, and hence the probability that all 
parties say 1 is at least a constant. 

Let X be the random variable given by (7^ I's in x) — (7^ O's in x). By the Central Limit 
Theorem, as n ^^ 00, the distribution of X approaches a normal distribution with mean and 
variance n. Let c = Y:i2e' "^^^ probability that an A^(0, n) normal variable exceeds c^J\ogk^/n is: 

1 - $(00^) > i^^^exp (-c2logfc/2) > 0(lA2.oi/(i-2.)2)_ 
2 cvlog k V27r 

Here $ denotes the cumulative distribution function of a standard normal variable, and the first 
inequality follows from the fact that 1 — $(x) > (1/x — l/x'^)4>{x) (see |F68j ). where 4){x) is the 
density function of a standard normal variable . 



Given that this happens, pessimistically assume that x contains just c^/\ogk^/n more I's than 
O's; i.e., x contains exactly n/2 + {c/2)^J\ogk^/n I's. We now show that the probability that a 
particular party using MAJ„ outputs 1 given x is at least 1 — 1/k. 

Consider the e-corrupted version of x the party sees; call it y. The number of I's in y is 
distributed as the sum of n Bernoulli trials, n/2 + {c/2)^/\ogk^/n of which have success probability 
1 — e, and n/2 — [c/2)\J\ogky/n of which have success probability e. We can use a single Chernoff 
bound to upper-bound the probability of getting fewer than n/2 I's in y. The expected number of 
I's is n/2 + (1 - 2e)c^/\ogk^/n = n/2 + 2^/\ogky/n. Since n/2 = (1 - 5){n/2 + 2^/\ogky/n) when 
5 = 2-y/log ky/n/{n/2 + 2^J\ogk^/n) > 2^J\ogk / ^/n, Chernoff tells us that the probability that y 
has fewer than n/2 I's is at most exp( °^ 2n ) ~ ^/k. 
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Thus as claimed, given a source string with at least c\/logk^/n more I's than O's, the probability 
a particular party outputs 1 is at least 1 — 1/k. Hence the probability that all parties output 1 is 
at least (1 - 1/k)^ = 0(1). 

Hence by taking n sufficiently large, we can make "PfclMAJ^; e) > Q,{l/k'^'^^'^^~'^'^' ). By applying 
the Berry-Esseen bounds on the rate of convergence in the Central Limit Theorem (see |F68j ). one 
can show that it suffices for n to be 0{k'^'^^'^^~^''' ). □ 

In the limit as n — > oo, all distributions involved in the calculation of 'Pfc(MAJ„; e) become 
normal, and it is possible to get some more or less closed forms for the limit: 

Proposition 4.5 

Jim7'fe(MAJ„;6) = 2E <^ { ^= ] (18) 

n odd 




where c(e) := ,._~f^ G (0,oo), X is a standard normal random variable, and I{x) := (j){^^^{x)). 

(We thank Nati Srebro for his help in calculating H18|).') The second formula H19|) can be used to get 
tighter bounds than in Theorem 11.71 For example, from H19|) we get that lim„^oo'PA:(MAJ„; 1/2 — 
V2/4) = 2/(fc + l). 

5 Computer-assisted results and open problems 

The problem well avails itself to analysis by computer. In particular, given any explicit function 
/ : {0,1}" — > {0,1}, a computer mathematics package can easily calculate 'P/c(/;e) exactly, as a 
function of k and e. Furthermore, if n is very small, a computer program can enumerate all anti- 
symmetric left-monotone functions on n bits. We determined there are "only" 135 such functions 
for n = 7 and 2470 such functions for n = 8. (The number jumps to 319124 for n = 9.) Thus for 
particular small values of n and k, we can completely solve the problem by comparing an explicit 
set of polynomials in e on the range (0, 1/2). 

As an example, we give a nearly complete analysis of the case n = 5. There are exactly 7 
antisymmetric left-monotone functions on n bits; they are MAJi, MAJ3, MAJ5, and four functions 
expressible as thresholds: Ti = r/i(3, 1, 1, 1, 1;4), T2 = r/i(2, 1, 1, 1, 0; 3), T3 = r/i(3, 2,2, 1, 1; 5), 
and T4 = Th{A, 3,2, 2,2; 7), where Th{ai, ... ,05; 6*) is 1 iff X]i=i ^«^« — ^- Table El shows Vk{f', e) 
for each of the functions. 

For small values of k, we plotted these polynomials for e S (0, 1/2). This led to the following 
facts, which in principle could be proved by elementary analysis: 

Fact 5.1 

• For n = 5, 2 < A; < 9, and any e, the best antisymmetric protocol is MAJi. 
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/ 


rk{f;e) 


MAJi 


e'' +(!-£)'' 


Ti 


1/16 (-6 e^ + 5 e* - 2 E^ + 4 6^)*= + 1/16 (1 + 6 e^ - 5 e* + 2 e'^ - 4 s^)'' + 1/16 (4 e - 10 e^ + 10 £■■* - 5 e* + 2 £^)'= + 1/16 (1 - 4 e + 10 e^ - 
lOe^ + Sc"* - 2.!^)'' + l/4(e - e^ +4e3 - Se*' +2e^)'' + 1/4(1 - e + s^ - 4^3 + Se* - 2e=)'= + 1/4(1 - 2e + 46^ - 6(!^ + 5e* - 2e=)'' + 
l/4(2e - 4e^ +6^3 - St" +2e^)'= + 3/8(e + e^ - 4e3 + Se-i _ 2e5)fc + 3/g(i _ J _ j2 ^4^3 _ 5 j4 ^je'^)* 


T2 


1/8 (-2 e^ +3e^)'= +l/8(l + 2e=' -3e^)'= +l/8(3e-6e^ +46^)'= + 1/8(1 -3e + 6e^ -4£3)'= + 3/8 £*= +3/8(1 - e)*" + 3/8 (1 - 2 E + 
3 e2 _ 2 e3)fc _,_ 3/g (2 e - 3 6^ + 2 E^)* 


MAJ3 


1/4 (-2 e^ + 3 6^)'= +1/4(1 + 2^3 - 3 6^)*= +3/4(2e - 3s^ +2e^)'= +3/4(1 - 2 £ + 3 e^ - 2£3)'= 


n 


1/8 (-6 e^ + 5e* - 2£^ +4 6^)'= + 1/8(1 + 6 6^ - Se* + 2£^ - 4 6^)'= + 1/16 (e - e^ + 4 t^ - 5 e" + 2 t^)* + 1/16(1 - e + s^ - 4 s^ + 5 e*' - 
26^)'! + 1/4(1 _2e + 4^2 -66^ + 58* -26=)'' + 1/4 (2e-4e2 +66=* -5£*+2e^)'' + 1/8 (1-6- £^+46^ -5e'' + 2£=)''' + 1/8 (f + e^ - 
4e^ + 5e* - 2e^)'° + 3/16 (8e^ - 5e* + 2£^ + 3e - Te^)*" + 3/16 (1 - 8e^ + Se*' - 2e^ - 3 e + 7e^)'° + 3/16 (2e^ - 5e* + 2e^ + 2e^ + 1 - 
2 e)* + 3/16 (-2 e^ + 5 e* - 2 e^ - 2 e^ + 2 e)* + 1/16 (2 e^ - 5 e* + 2 e^ + 2 e^)*" + 1/16 (1 - 2 e^ + 5 e<l - 2 e^ - 2 e^)* 


T4 


l/16(e^+6f3-10£*+4£^)'= + l/16(l-e^-6E3 + 10f*-4eS)'= + l/8(e+2<!2_g£3 + igj4_4^5)fc_,_i/g(i_g_2£2_,_g^3_iQ^4_,_4^5jfe + l/lg(l_ 

2e + E2 + 6e3_i0e<l+4e^)'= + l/16 (2 £ - e^ -6 E^ + IQ e* -4 e= )*= +3/16 (5 e^ - 10 e^ + 10 e* -4 e^)*" +3/16 (1-5 e^ + 10 e^ - 10 e'*+4 e^)*^ +3/8 (3 e - 
8e^ + 12f3-10e-*+4 6^)'=+3/8(l-3s + 8s2-12f3+10e*-4e=)'=+3/16 (1-2 e + 5 e^-lO f^ + lO e*-4 6^)*= +3/16 (2 6-5 e^+lO e^ -10 e'*+4 6^)*= 


MAJ5 


1/16 (10 e^ - 15 6" +6e^)'= + 1/16 (1 - 10 e^ + 15 e* - 6 6^)'= + 5/16 (6 e^ - 14 e^ + 15 e"* - 6 e^)*" + 5/16 (1 - 6 £^ + 14 e^ - 15 e* + 6 e^)*" + 
5/8 (3 e - 9 e^ + 16 e^ - 15 e* + 6 e^)*" + 5/8 (1 - 3 e + 9 e^ - 16 e^ + 15 e* - 6 e^)*" 



• For n = 5, k = 10, 11, there exist < e^ < e^' < 1/2 such that MAJ3 is the best antisymmetric 
protocol for e £ [e^, e'^], and MAJi is the best antisymmetric protocol for all other e. 

• For n = 5, k = 12, there exist < e'^, < e'^' < e'^' < 1/2 such that MAJ5 is the best 
antisymmetric protocol for e £ [e^,e'^'], MAJ3 is the best antisymmetric protocol for e £ Wk^^'k']) 
and MAJi is the best antisymmetric protocol for all other e. 

The pattern for fc = 12 appears to hold for all higher k, with MAJ5 dominating more and more 
of the interval, as expected from Theorem 11.51 

At this point we can prove two facts mentioned earlier: 

Proposition 5.2 There exist k, e, odd n, and odd 1 < r < n such that MAJ,. is a superior protocol 
to both MAJi and MAJ„. 

Proof: Substitute A; = 10, e = .26 into Table El By explicit calculation, T'loCMAJi; .26) < .0493, 
lJio(MAJ5;.26) < .0488, pioCMAJs; .26) > .0496. □ 

Proposition 5.3 There exist n, k, and f £ Bk such that the probability all parties agree on 1 
differs from the probability all parties agree on 0. 

Proof: With n = 5, k = 3, and / the left-monotone function with minterms 10010 and 01101, 
explicit calculation gives 1 - m ,+g ,2 _ 4m ,3 ^ ml ,i . 2m. ,5 + m^ ,6 _23i ^7 ^-^^^ ^s _^^^9 ^^^ ^10 and i-f|£ + M,2_ 
m e3 _,_ M e* _ m j5 + m j6 + g ^7 _ 24 £» + 15 ^9 _ 3 ,10 for the probabilities of agreement on 1 and 0, respectively. 

D 

We end with two open problems we've been led to consider: 

Open Problem 1 Prove or disprove: For fixed n, e, and 2 < k < 9, the best antisymmetric 
protocol is for all parties to use MAJi. 
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Open Problem 2 Prove or disprove: There is a universal constant C < oo such that for every 
k,e, 

7'fc(MAJ„.;e) < C lim P(MAJ„, A;, e), 



n—foo 
n odd 



where n* is any odd number (presumably maximizing 'Pfc(MAJ„*; e)J. I.e., the limiting value of 
Vk{MA^n^,e) is no worse than the success probability of the best majority, up to a constant factor. 

The worst constant C we know to be necessary in Open Problem 21 is vr/2, from the case k = 2, 
e^ 1/2. 

If Conjecture O and Open Problem|21are both verified, then we can get tight (up to a constant) 
upper and lower bounds for the optimal value of V{fi, . . . , fk',e) under antisymmetric protocols, 
for any A;, e, and unrestricted n, by using Proposition 14.51 

Acknowledgments: We are most grateful to Oded Schramm for many helpful suggestions, 
ideas and proofs. We are also grateful to Nati Srebro for helpful simulations and stimulating 
discussions. 
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